{
  "id": 13399609,
  "title": "Scoped Supabase tokens: limit what your app’s agent can change",
  "url": "https://urgent.news/2026/10/10/scoped-supabase-tokens-limit-what-your-apps-agent-can-change",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-10T11:48:03.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/davekurian/scoped-supabase-tokens-limit-what-your-apps-agent-can-change-251n"
  },
  "original_language": "en",
  "account": "Supabase has introduced scoped personal access tokens, providing developers with a way to limit what their app's agent can change. These tokens are created in the Supabase dashboard, allowing developers to select specific organizations, projects, and permissions. Unlike classic tokens, scoped tokens cannot grant more access than the user originally had.\n\nWhen creating a scoped token, it's crucial to understand the operations the automation job will perform. Mapping these operations to the required permissions helps ensure that the token has only the necessary access. Each operation, such as linking a local repository to a project, reading project settings, changing database objects, or managing another platform resource, must be carefully considered.\n\nPermissions cannot be edited after creation, so it's essential to choose the appropriate token form based on the workflow. Classic tokens carry the permissions of the account that created them, including current and future access. In contrast, scoped tokens are constrained to the resources and permissions selected at creation.\n\nWhen setting an expiry for a scoped token, it's recommended to use a preset or a custom date up to one year. If a user loses access to a project, the scoped token will lose that access too. When storing the token, ensure it's not written in source code, terminal transcripts, issue comments, or logs. Instead, restrict access using a CI secret manager or the appropriate local secret store.\n\nTo avoid breaking existing builds, replace one consumer of the current token at a time with the scoped token. Thoroughly test both the expected access and expected denial outside the selected scope. Keep a rollback plan in place to revert to the original token if necessary. Finally, record which job owns each token, who can rotate it, and when it expires.",
  "summary": "A personal access token can give a coding agent, CI job, or MCP server access to Supabase projects. The risk is easy to miss: a classic token follows the account’s access, including access to organizations and projects added later. Supabase’s scoped personal access tokens offer a narrower option. You choose the organizations or projects and permissions when creating the token, then use it where…",
  "key_points": [
    "Scoped personal access tokens limit app agent's actions in Supabase",
    "Developers select specific organizations, projects, and permissions for tokens",
    "Scoped tokens cannot grant more access than the user originally had"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}